SVP, Head of Security Technology

We need to output HTML fragment with sections: h3 headings for sections present: About the role? The posting includes a description about Bloom Energy vision etc. That could be "About the role" or maybe "About the company". The instruction: use h3 for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). We need to include sections only when posting has real, specific content. We have content: description about company and role (vision). Could map to "About the role". Then responsibilities list. Then skills and experience (maybe "Qualifications" or "Skills"). There's also "Preferred Qualifications And Technologies". Could combine into "Qualifications". Also "Skills And Experience" heading. Could treat as "Skills". Also benefits: they list benefits. Pay: they give salary range. Schedule: they mention fully on-site, 5 days in office role. So we have schedule info. Also location: Newark, Delaware, reporting to CSO. Could include in About the role or maybe as metadata short p. We'll not repeat job title. We must not include boilerplate like EEO etc. Remove those paragraphs. We must preserve all substantive info. So we need to include details: role will report to Chief Security Officer based in Newark, Delaware. This is a fully on-site, 5 days in office role. That's schedule/location. Responsibilities: list bullet points. Skills And Experience: list bullet points (education, experience). Preferred Qualifications And Technologies: list many items. Benefits: list. Pay: Salary Ranges $130,400.00 - $187,600.00. Schedule: fully on-site, 5 days in office. We need to avoid filler like "commensurate with experience". Not present. We must not invent or summarize away detail. Keep details. We need to output only HTML fragment, no html/body tags, no markdown fences. We'll structure:

About the role

At Bloom Energy, our vision for a world powered by clean, reliable, and affordable energy is more than just a dream—we’re making it reality. For over two decades, we’ve been at the forefront of the global energy transition, pioneering solutions that empower critical industries to thrive in a rapidly digitizing, energy-intensive world. From revolutionizing power for AI-driven data centers to ensuring resilience for hospitals, electric grids, manufacturing facilities, and utilities, our solid oxide fuel cell (SOFC) and solid oxide electrolyzer (SOEC) technologies are redefining what’s possible by delivering energy abundance for all. With more than 30,000 fuel cell modules deployed worldwide, we are the trusted partner for Fortune 100 companies and innovators alike. Our cutting-edge solutions enable unparalleled “time-to-power” capabilities, reliability, and sustainability, ensuring our customers remain ahead in a world where soaring energy demand and intensifying energy scarcity are rapidly becoming the new norm. At Bloom, we thrive on collaboration, bold thinking, and relentless innovation. We believe that, together, we can create a brighter, more sustainable future while tackling the most pressing challenges of the 21st century. We are looking for an OT Security Architect to join our team in one of today’s most exciting technologies. This role will report to Chief Security Officer based in Newark, Delaware. This is a fully on-site, 5 days in office role.

Then responsibilities:

Responsibilities

• Deploy, configure, and tune OT security platforms across manufacturing sites endpoint protection, inline IPS, asset discovery, secure remote access, media scanning kiosks, and PLC backup including rulesets, allowlists, exclusions, and detection tuning on production assets.
• Own operational health of deployed tooling: agent coverage, sensor health, license utilization, upgrades, and version currency.
• Design and implement IT/OT convergence controls: OT DMZ at Level 3.5, brokered access, data flows, identity and directory integration, patching paths, and monitoring feeds.
• Implement defense-in-depth segmentation aligned to the Purdue model and ISA/IEC 62443 zone-and-conduit design, VLANs and rulesets, micro segmentation, and virtual patching for legacy assets partnering with Network Engineering on switching, routing, firewalls, wireless, IIoT, edge, and WAN.
• Run OT asset discovery and integrate telemetry into enterprise SIEM, EDR/XDR, NDR, and vulnerability management; maintain inventory and drive end-of-life OS remediation.
• Implement and test PLC/HMI backup, versioning, and golden-image recovery; support OT incident response and recovery, and lead POCs and production rollouts for new OT security technologies.

Then qualifications/skills: We could have

Qualifications

with combined required and preferred. But instruction: prefer few substantive sections over many thin ones. Could combine Skills And Experience and Preferred Qualifications into one Qualifications section. Let's create:

Qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, Electrical Engineering, Industrial Engineering, Computer Engineering, or a related technical discipline, or equivalent hands-on experience.
• 8+ years of cyber security, network, or infrastructure engineering experience, including 4+ years hands-on OT/ICS cyber security in production industrial or manufacturing environments.
• Demonstrated hands-on deployment and operation of OT security tooling at multiple sites.
• Strategy-only, advisory-only, or assessment-only backgrounds will not be considered.
• Preferred qualifications and technologies:
  • Secure Remote Access: brokered vendor and engineer access to Levels 0–3, session recording, MFA, jump hosts, browser isolation
  • Malware Scanning Kiosks: USB and vendor media inspection at plant entry points, scan engines, sanitization, and media workflows
  • OT Endpoint Security: OT-native anti-malware and application allows listing on HMIs, engineering workstations, and legacy or unsupported OS
  • OT Backup: PLC/HMI and production equipment configuration backup, version control, and tested golden image restore on production assets
  • Network Segmentation: OT DMZ at Level 3.5, zone-and-conduit design, VLAN-to-firewall migration, micro segmentation, inline IPS and virtual patching
  • OT Vulnerability Management: passive and active OT asset discovery, risk-based prioritization, compensating controls for non-patchable assets
  • Purdue Model: applied Levels 0–5 data-flow design and enforcement of trust boundaries across live plants
  • Experience with TXOne, Claroty, Nozomi Networks, Dragos, Armis, KASM, Dispel, Salvador Technologies, OPSWAT, Octoplant, Cisco Cyber Vision / ISE / Catalyst IE, or equivalent OT security platforms.
  • Enterprise security integration: SIEM, SOAR, XDR/EDR, NDR, PAM, and vulnerability management platforms.
  • Windows and Linux server administration, Active Directory, virtualization, storage, backup, and hybrid cloud connectivity.
  • Layer 2/3 switching and routing, VLANs, wireless, firewall rule design, NAT, VPN, and WAN connectivity.
  • Scripting and automation (PowerShell, Python) for deployment, configuration management, and reporting at scale.
  • PLC platforms (Siemens, Rockwell, Schneider, GE, ABB), SCADA, and HMI systems.
  • Industrial protocols: Modbus, DNP3, Profinet, OPC/OPC-UA, EtherNet/IP, BACnet.
  • Applied ISA/IEC 62443 and NIST SP 800-82: implementing controls, audit support, risk assessment, threat intelligence, and vulnerability management.
  • Multi-site, multi-country manufacturing support experience; MES, historian, LIMS, and quality systems exposure.
  • ERC CIP audit or utility customer cyber security requirement support.
  • Certifications: GICSP, GRID, GCIP, GPPA, ISA/IEC 62443 Fundamentals or Specialist, CISSP, CCNP or equivalent.
  • Ability to work safely on production floors, onsite in Delaware, with travel up to 25% and off-hours work during maintenance windows.

But nested ul inside li may be okay but maybe better to keep as separate sections: Skills and Preferred Qualifications separate? However instruction: prefer few substantive sections over many thin ones. Could keep two sections: Skills and Experience (required) and Preferred Qualifications (optional). That's two sections, still okay. Let's do:

Skills and Experience

(required items)

Preferred Qualifications

(preferred items) Then Benefits:

Benefits

• competitive Medical, Dental, and Vision plans with a large employer contribution
• 401(k) Retirement Plan with company match
• generous Mental Health Support services
• Legal services
• virtual Physical Therapy access
• Fertility & Family Forming benefits
Pay:

Pay

Salary Ranges $130,400.00 - $187,600.00

Schedule:

Schedule

Fully on-site, 5 days in office.

We also need to include location/reporting maybe in About the role already. We must not repeat job title. Not include Job ID. We must not include boilerplate EEO etc. Already removed. Check that we didn't include any filler like "commensurate with experience". Not present. Make sure we preserve all substantive info: The responsibilities list includes all bullet points exactly as in posting. Need to ensure we didn't lose any details. Let's copy responsibilities exactly: - Deploy, configure, and tune OT security platforms across manufacturing sites endpoint protection, inline IPS, asset discovery, secure remote access, media scanning kiosks, and PLC backup including rulesets, allowlists, exclusions, and detection tuning on production assets. - Own operational health of deployed tooling: agent coverage, sensor health, license utilization, upgrades, and version currency. - Design and implement IT/OT convergence controls: OT DMZ at Level 3.5, brokered access, data flows, identity and directory integration, patching paths, and monitoring feeds. - Implement defense-in-depth segmentation aligned to the Purdue model and ISA/IEC 62443 zone-and-conduit design, VLANs and rulesets, micro segmentation, and virtual patching for legacy assets partnering with Network Engineering on switching, routing, firewalls, wireless, IIoT, edge, and WAN. - Run OT asset discovery and integrate telemetry into enterprise SIEM, EDR/XDR, NDR, and vulnerability management; maintain inventory and drive end-of-life OS remediation. - Implement and test PLC/HMI backup, versioning, and golden-image recovery; support OT incident response and recovery, and lead POCs and production rollouts for new OT security technologies. Yes. Skills and Experience required: - Bachelor’s degree in Cybersecurity, Computer Science, Electrical Engineering, Industrial Engineering, Computer Engineering, or a related technical discipline, or equivalent hands-on experience. - 8+ years of cyber security, network, or infrastructure engineering experience, including 4+ years hands-on OT/ICS cyber security in production industrial or manufacturing environments. - Demonstrated hands-on deployment and operation of OT security tooling at multiple sites. - Strategy-only, advisory-only, or assessment-only backgrounds will not be considered. Preferred Qualifications list: need to capture all items. Let's extract from posting